Joombri Freelance, pre 1.6.5, SQLi

JoomBri freelance extension pre 1.6.5. suffers major sqli exploit. No contact from developer, Notified by Ruth Cheesley...

XCloner Backup and Restore [com_cloner], 3.5.2

XCloner Backup and Restore comcloner, 3.5.2, probably previous, multiple vulnerabilities...

Spider Form Maker by Web-Dorado [com_formmaker],3.4 and lower

Spider Form Maker by Web-Dorado comformmaker,3.4 and lower,SQL Injection Developer statement This vulnerability was fixed in version 3.4.1 and above. The version 3.4.1 was released on 2014-09-10...

eXtplorer 2.1.6 released

http://extplorer.net/news/15 Please update to this new eXtplorer version as it fixes an XSS security issue. Also the UTF-8 fix is recommended for users with non-ASCII filenames...

Visforms pre 2.1.2 and pre 3.1.2

Update so that information submitted with Visforms cannot be disclosed unintentionally. http://www.vi-solutions.de/en/announcements/366-security-updates-for-visforms-2-1-2-and-3-1-2-released...

HDFLVPlayer 2.2 + previous

Joomla HDFLVPlayer plugin versions 2.2 and previous SQL Injection Version 2.3 Fixed SQL injection in download.php file.https://www.apptha.com/category/extension/Joomla/HD-FLV-Player Version 2.2 Resolved cross domain issue in download.php & email.php files...

HDFLVPlayer, 2.0, Directory Traversal

HDFLVPlayer, 2.0, Directory Traversal Contus/apptha developers statement We fixed the directory traversal issue and updated the version with 2.2 UpdateNoticeURL http://www.hdflvplayer.net/hd-flv-player-download.php...

youtube gallery, 4.1.7,

youtube gallery, 4.1.7, SQL Injection Extension Update Details 4.1.9 UpdateNoticeURL http://www.joomlaboat.com/youtube-gallery...

plg_codehighlight, 1.0.1 , xss

union-d codehighlight, 1.0.1 , XSS Cross Site Scripting...

sectionex, 2.5.96

sectionex, , SQL Injection Extension Update Details Version 2.5.104 Update Notice URL http://stackideas.com/blog/important-security-release-for-sectionex-2-5...

[20260809] - Core - Improper ACL checks when injection schema.org contact data

An improper access check injects contact information for unaccessible contact items into schema.org snippets...

[20260808] - Core - Improper ACL checks for batch copy actions

An improper access check allows unauthorized users to perform copy batch operations on uneditable items...

[20260804] - Core - Improper ACL checks for custom fields webservice endpoints

An improper access check allows unauthorized users to create fields for inaccessible components...

[20260704] - Core - XSS in com_templates

Lack of escaping leads to an XSS vulnerability in the file management view of comtemplates...

rsmail

Extension: RSMail! Version: Old 1.22.26, 1.22.27, 1.22.28 / New 1.22.29 Update details: Versions affected 1.19.20 through 1.22.28. Self XSS allows remote authenticated attackers to inject arbitrary web script or HTML via a crafted parameter. Fixed in 1.22.29 Update URL:...

EDocman, 1.23.3, XSS (Cross Site Scripting)

developer update https://joomdonation.com/forum/edocman/75400-01st-august-2023-new-version-1-24-7-xss-issue-fixed.html...

Akeeba LoginGuard,3.1.1 and all lower versions,Information Disclosure

Akeeba LoginGuard,3.1.1 and all lower versions,Information Disclosure Update via developers website...

Jevents 3.4.49 Various

Jevents 3.4.49 Various UpdateNotice URL https://www.jevents.net/blog/jevents-3-4-50-released-all-users-should-upgrade...

JEXTN Question And Answer ,3.1.0,SQL Injection

JEXTN Question And Answer ,3.1.0,SQL Injection...

LMS King Lite, SQL Injection

LMS King Lite and LMS King Professional by king-products.net, versions up to 3.2.3.19 lite and 3.2.3.47 pro, SQL Injection resolution: update to version 3.2.3.20 lite and 3.2.3.48 pro update notice url: https://www.king-products.net/lms-king.html...

Appointment, v1.1 ,SQL Injection

Appointment by Harmis Technology joomlaextensions.co.in, v1.1, SQL Injection...

AYS Quiz,1.0,SQL Injection

AYS Quiz, 1.0,SQL Injection...

MediaLibrary,3.5.4, SQL Injection

MediaLibrary by Ordasoft, 3.5.4, SQL Injection Resolution: update to 3.5.5 Update notice: http://ordasoft.com/News/News/media-library-security-update.html...

Joomla Spider FAQ by Web-Dorado pre 1.3

Joomla Spider FAQ by Web-Dorado pre 1.3 ,SQLi Update to 1.3...

Huge IT Catalog,1.0.6,SQL Injection

Huge IT Catalog,1.0.6 and previous versions ,SQL Injection and XSS vulnerability Resolution: update to 1.0.8 Update notice: https://huge-it.com/joomla-extensions-security-notice/...

Gallery WD version 1.2.3 and previous

Gallery WD version 1.2.3 and previous XSS Cross Site Scripting Resolution: Update to version 1.2.5 Update notice URL: http://web-dorado.com/products/joomla-gallery.html...

JEvents pre 3.1.37

Version 3.1.37 eliminates a low risk theoretical XSS exploit and SQL injection exploit. UpdateNoticeURL https://www.jevents.net/jevnews/234-jevents-32 ttweetfsubscribe...

HDFLVPlayer 2.2 and previous

HDFLVPlayer versions 2.2 and all previous Email exploit Version 2.3 Fixed SQL injection in download.php file.https://www.apptha.com/category/extension/Joomla/HD-FLV-Player Version 2.2 Resolved cross domain issue in download.php & email.php files...

MijoShop, 2.4.x - 2.5.x,

MijoShop, 2.4.x - 2.5.x, SQL Injection Extension Update Details 2.5.2 UpdateNoticeURL http://miwisoft.com/blog/mijoshop-252-security-update-released...

Codels codehighlighter 1.4

Codels plgcontentcodehighlighter version 1.4 and previous. XSS Cross Site Scripting...

Jinc, all versions,

Jinc, all versions, XSS Cross Site Scripting UpdateNotice URL http://lhacky.altervista.org/jextensions/index.php/component/content/article/21-news/jinc/100-security-issue-on-jinc-1-0-1...

flashChart Content Plugin,

flashChart Content Plugin, 1.2.1, XSS Cross Site Scripting Extension Update Details updatet/fixed XSS vulnerability in open-flashchart-swf for external call "get-data" UpdateNoticeURL http://www.jschmidt-systemberatung.de/index.php?lang=en=227...

civic crm 422

upload exploit /RFI 260413 developer http://civicrm.org/category/civicrm-blog-categories/civicrm-v43 release 4.3.1 Authors:...

[20260805] - Core - Improper ACL checks for category webservice endpoints

An improper access check allows unauthorized users to create categories for inaccessible components...

rsblog

Extension: RSBlog! Version: Old 1.14.4, 1.14.5 / New 1.14.6 Update details: Versions affected 1.11.6 to 1.14.5 Stored XSS allows remote authenticated attackers to inject arbitrary web script or HTML via the tag parameter. Fixed in 1.14.6 Update URL:...

Next Gen Editor,2.1.0,SQL Injection

Next Gen Editor, 2.1.0, SQL Injection and multiple other vulnerabilities resolution: update to version 2.2.0 update notice: http://nextgeneditor.com/index.php/en/support/forum/installation-issues/3957-new-security-release...

ZH Yandex Map, 6.1.1.0, SQL Injection

ZH Yandex Map, 6.1.1.0 and previous versions, SQL Injection Resolution: update to 6.2.0.0 Update notice: http://zhuk.cc/2017/10/05/zh-yandexmap-security-update/...

Keen IT Photo Contest, 1.0.2, SQL Injection

Keen IT Photo Contest, 1.0.2, SQL Injection...

Event Registration Pro,4.1.3,SQL Injection

Event Registration Pro, 4.1.3 and previous, SQL Injection Resolution: update to version 4.1.4 Update notice: https://www.joomlashowroom.com/blog/event-registration-pro-4-1-4-security-release...

JoomRecipe,1.0.3,SQL Injection

JoomRecipe ,1.0.3,SQL Injection UpdateNotice URL https://www.joomboost.com/blog-updates/entry/joomrecipe-version-1-0-4-security-announcement.html changelog Changelog Url https://www.joomboost.com/components-changelogs/60-joomrecipe-changelog.html...

J-Hotel Portal,6.0.2,SQL Injection

J-Hotel Portal by cmsjunkie.com, 6.0.2, SQL Injection...

JMultipleHotelReservation, 6.0.3, SQL Injection

JMultipleHotelReservation by CMS Junkie, 6.0.3, SQL Injection Resolution: Update to 6.0.4 Update notice: http://www.cmsjunkie.com/blog/joomla-hotel-reservation-6-0-4-release/...

recipe manager, 2.2

recipe manager by joomla6teen.com, 2.2, SQL Injection...

Huge IT gallery,1.1.5,SQL Injection

Huge IT gallery,1.1.5,SQL Injection resolution: update to 1.1.9...

RSMonials,2.2 and previous,XSS (Cross Site Scripting)

RSMonials, 2.2 and previous versions, XSS Cross Site Scripting also insecure file upload...

Joom Donation, versions before 4.1, Information Disclosure

Joomdonation extensions, Information Disclosure Joom Donation versions before 4.1 Resolution: update to 4.1 Update notice URL: http://joomdonation.com/forum/joom-donation/50513-joom-donation-version-4-1-released.html...

failedloginattempts v1.0.1

plgfailedloginattemptsv1.0.1j25j30, 1.0.1, Information Disclosure Developers update statements 12-Dec-2014 : v1.1.0 http://www.web357.eu/news/releases/68-failed-login-attempts-v1-1-0-has-been-released-security-release.html...

Google Maps by Reumer, 3.5, Malicious update

Google Maps by Reumer, from mapsplugin.com, version 3.5, malicious update Version 3.3 of this plugin is listed in the JED and appears to be clean. However once installed, the Joomla update manager prompts you to update this extension to a version 3.5 which is not officially published. This versio...

Price Alert for Virtuemart,3.0.4,SQL Injection

Price Alert for Virtuemart by WebOrange, 3.0.4 and all previous, SQL Injection...

DT Register, sql/xss, 3.1.12 / 2.8.18 and previous

DT Register Vulnerable version: 3.1.12 / 2.8.18 and previous sql/xss http://www.dthdevelopment.com/dth-news/dt-register-3.1.13-security-release.html http://www.dthdevelopment.com/joomla-components/dt-register-event-registration-for-joomla.html developer did not inform VEL...